The short answer
In January 2024, a threat actor using the alias “emo” offered for sale a dataset of roughly 15.1 million Trello accounts containing email addresses, names, and usernames — no passwords. Have I Been Pwned records the incident as a verified breach dated January 16, 2024, affecting 15,111,945 accounts. [1][2][4]
Atlassian says its investigation found no evidence that the data was obtained through unauthorized access to Trello’s systems. The threat actor fed a pre-existing list of email addresses into a public Trello REST API endpoint that could be queried without logging in and that mapped an email address to its public profile. Atlassian confirmed the scraping, disputes the “breach” label, and changed the API in January 2024 so unauthenticated requests can no longer look up another user’s profile by email. The full dataset was publicly released on a hacking forum in mid-July 2024. [3][5]
This record covers Trello, the cloud-hosted kanban product owned by Atlassian. It does not treat advisories for other Atlassian products as Trello incidents. [3]
Classification: An API or public resource was queried at scale without a confirmed system intrusion. Learn how incident terms differ.
Accounts affected
15,111,945 per Have I Been Pwned; the hacking-forum listing advertised 15,115,516 unique lines [2][4]
Data exposed
Email addresses, names, and usernames — no passwords [1]
Root cause
Enumeration of an unauthenticated public REST API using a pre-existing email list — not a system intrusion [1][3]
Vendor investigation finding
Atlassian said it found no evidence of unauthorized access to Trello systems [3]
Vendor response
Public statement on January 23, 2024; the API was changed so unauthenticated users can no longer request profiles by email [3]
Incident timeline.
-
Dataset compiled and offered for sale
A threat actor using the alias “emo” advertises a dataset of Trello account records on a hacking forum — “Contains emails, usernames, full names and other account info. 15,115,516 unique lines,” per the forum post. Have I Been Pwned records January 16, 2024 as the breach date. [4][2]
-
Added to Have I Been Pwned
Have I Been Pwned adds Trello as a verified entry covering 15,111,945 accounts, with data classes limited to email addresses, names, and usernames. [1][2]
-
Atlassian publishes its statement
Atlassian publishes “Setting the record straight about Trello user profile data,” stating that an exhaustive investigation found no evidence the data was gathered by unauthorized access, and confirms an API change: unauthenticated users and services can no longer request another user’s public information by email. [3][6]
-
Full dataset released publicly
The threat actor releases the full dataset of 15,115,516 Trello profiles on a hacking forum, as reported by BleepingComputer, moving the data from a paid listing to effectively public availability. [5]
-
Atlassian confirms the release
Atlassian updates its January statement to confirm that the public Trello user profile data obtained via API misuse in January 2024 has been released. [3]
What happened in the January 2024 incident
Trello’s public REST API included an endpoint that accepted an email address and returned the matching account’s public profile — and it could be queried without logging into a Trello account. A threat actor who already held a large list of email addresses submitted them to this endpoint to determine which addresses had Trello accounts, linking private email addresses to public profile data (names and usernames) at scale. [4][3]
The threat actor told BleepingComputer they fed a list of about 500 million email addresses into the API. That input-list figure is the attacker’s own claim and has not been confirmed by Atlassian, which confirmed only that the actor used “a pre-existing list of email addresses.” [4][3]
The resulting dataset was offered for sale in mid-January 2024. Have I Been Pwned counts 15,111,945 affected accounts, while the forum listing advertised 15,115,516 unique lines; both round to 15.1 million. The exposed data classes are email addresses, names, and usernames. No passwords, payment data, or board content were part of the dataset. [2][4]
Was it a “breach”? What Atlassian disputes
Atlassian contests the “breach” framing. Its statement reads: “We completed an exhaustive investigation and did not find evidence to support that this data was gathered by unauthorized access.” In Atlassian’s characterization, a threat actor tested a pre-existing list of email addresses against publicly available Trello user profiles. [3][4]
The dispute is about the label, not the event. Have I Been Pwned carries Trello as a verified entry obtained “by enumerating a publicly accessible resource,” and security press widely described the dataset as a breach or leak. Atlassian’s remediation — removing unauthenticated email-based profile lookups from the API in January 2024 — addressed the endpoint design that made the mass linkage possible. Authenticated email-based lookup of public profile data continued to work after the change. [1][3][6]
For anyone assessing the event: no Trello system was intruded upon per Atlassian’s investigation, and no passwords were exposed — but 15.1 million email addresses became durably linked to real names and usernames, which is exactly the raw material targeted phishing needs. [3][1]
The July 2024 public release
On July 16, 2024, BleepingComputer reported that the same threat actor had released the complete dataset of 15,115,516 Trello profiles on a hacking forum, after originally offering it for sale in January. Atlassian confirmed the release in a July 18, 2024 update to its statement. [5][3]
Once released for a nominal fee of eight forum credits (about $2.32) rather than sold at its original asking price, the dataset became accessible to essentially any forum user. The practical consequence for affected users is a persistent, elevated phishing and identity-linkage risk: messages can reference a recipient’s real name and Trello username to appear legitimate. [5]
The 2018 public-board exposures (misconfiguration, not a system flaw)
In 2018, a separate class of Trello exposure drew sustained press coverage: boards that users had set to “public” were indexed by search engines and leaked sensitive data. In May–June 2018, Flashpoint analyst David Shear documented hundreds of publicly viewable Trello boards exposing passwords and other sensitive information, reported by Krebs on Security. [7]
In August 2018, The Intercept reported that the governments of the United Kingdom and Canada had exposed sensitive material on public Trello boards — including software bug details, security plans, and passwords for servers, official internet domains, conference calls, and an event-planning system. In September 2018, reporting on researcher Kushagra Pathak’s findings documented 60 publicly accessible Trello boards belonging to the United Nations. [8][9]
The root cause in this incident class was user misconfiguration — board owners choosing the public visibility setting — not a vulnerability in Trello’s systems. It is documented here because it recurs in any tool whose sharing defaults users misunderstand, and because it shaped how organizations audit Trello board visibility. [7][8]
What affected Trello users should do
Check whether your email address appears in the dataset at Have I Been Pwned, which indexes the verified Trello entry. If it does, expect phishing that quotes your real name or Trello username, and treat unsolicited “Trello” or “Atlassian” emails with corresponding suspicion. [1]
No passwords were exposed in this incident, so a password reset is not strictly indicated by the scraping itself — but if your Trello password is reused anywhere, replace it with a unique one and enable two-factor authentication. If your team runs Trello boards, audit their visibility settings; the 2018 exposures show how easily “public” boards escape into search indexes. [1][7]
How SealTask relates to this incident class
Honest scoping first: no hosted service is immune to account-level enumeration or scraping, and SealTask keeps account email addresses and operational metadata server-visible. For a disclosure limited to content already stored by the service, SealTask stores task titles, task bodies, notes, comments, checklists, and attachments as client-encrypted ciphertext rather than readable text. That does not protect against a compromised device, malicious code delivered to a client, account takeover, or exposure of server-visible metadata. SealTask also has no public-board visibility mode; projects are shared explicitly with named collaborators. [10]
Frequently asked questions.
Has Trello been hacked?
Trello’s systems were not intruded upon, according to Atlassian’s investigation. In January 2024 a threat actor scraped about 15.1 million Trello account profiles (email addresses, names, and usernames) by feeding an existing email list into an unauthenticated public API endpoint, and released the full dataset in July 2024. Separately, in 2018, boards that users had set to public exposed sensitive data — a user misconfiguration, not a Trello system flaw. [3][1][2][7]
What data was exposed in the 2024 Trello data breach?
Email addresses, names, and usernames for 15,111,945 accounts, per Have I Been Pwned’s verified entry dated January 16, 2024. No passwords, payment information, or board content were included. [1][2][3]
Were Trello passwords leaked?
No. The scraped dataset contained email addresses, names, and usernames only. Have I Been Pwned’s data classes for the Trello entry list no passwords. [1][2]
Did Atlassian confirm the Trello breach?
Atlassian confirmed the scraping happened but disputes calling it a breach. It said an exhaustive investigation found no evidence that the data was gathered through unauthorized access. Atlassian changed the Trello REST API in January 2024 so unauthenticated users and services can no longer request another user’s public information by email address. [3]
How do I check if my Trello account was affected?
Search your email address on haveibeenpwned.com. The Trello entry is verified, dated January 16, 2024, and covers 15,111,945 accounts. [1][2]
Is the Trello API issue fixed?
The specific mechanism was closed in January 2024: Atlassian changed the API so unauthenticated users and services can no longer request another user’s public profile by email address. The scraped dataset itself, however, was publicly released in July 2024 and remains in circulation, so the phishing risk to affected users persists. [3][5]
Related records
Sources
All sources last accessed . Corrections: email hello@sealtask.com with a source and we will review and correct.
- 01 Have I Been Pwned: Trello breach entry - Human-readable verified entry — occurrence month, rounded account total, and data classes: email addresses, names, and usernames
- 02 Have I Been Pwned API: exact Trello breach record - Machine-readable verified entry — breach date January 16, 2024; added January 22, 2024; exact affected-account total 15,111,945
- 03 Atlassian: “Setting the record straight about Trello user profile data” - Vendor statement of January 23, 2024, updated July 18, 2024 — investigation findings, API change, and confirmation of the July release
- 04 BleepingComputer: “Trello API abused to link email addresses to 15 million accounts” - January 2024 reporting — forum listing text, the attacker’s described method, and the attacker-claimed 500-million-email input list
- 05 BleepingComputer: “Email addresses of 15 million Trello users leaked on hacking forum” - July 16, 2024 reporting on the public release of the full dataset
- 06 Dark Reading: “Atlassian Tightens API After Hacker Scrapes 15M Trello Profiles” - Independent corroboration of the API change and Atlassian’s characterization
- 07 Krebs on Security: “Further Down the Trello Rabbit Hole” - June 2018 investigation — Flashpoint analyst David Shear documented hundreds of public Trello boards exposing passwords and sensitive data
- 08 The Intercept: UK and Canadian government data exposed on public Trello boards - August 16, 2018 reporting on government material exposed via public boards, including server passwords and security plans
- 09 TechTarget: “UN exposes sensitive data on public Trello boards” - September 2018 reporting on researcher Kushagra Pathak’s discovery of 60 publicly accessible United Nations Trello boards
- 10 SealTask security architecture - What SealTask encrypts client-side and which operational metadata remains server-visible
Prefer task content protected at rest?
SealTask encrypts task titles, notes, comments, and attachments before upload. A compromise limited to stored server data would expose ciphertext for that content; account metadata, active sessions, client delivery, and devices remain separate risks.